Forest Global Training Partners

Cyber Risks · Unit 42 Palo Alto Networks

Threat Assessment: Ryuk Ransomware

Summary: On Oct. 28, 2020, CISA, the FBI and HHS issued a joint alert warning of an increased and imminent cyber threat to the U.S. healthcare and public health sector, with observed activity including Trickbot malware that can lead to Ryuk ransomware. The alert followed a Ryuk attack that disrupted all U.S. Universal Health Services sites for weeks, with similar attacks reported at hospitals in Oregon and New York and a Philadelphia health tech organization.

What's compelling: Ryuk is often not loaded until weeks or months after the initial Trickbot or BazaLoader infection, so a network that looks clean today may already be enumerated and staged for encryption. The U.S. government deemed this activity an imminent threat to healthcare, and the operators learn the environment using tools native to it, such as PowerShell and Windows Management Instrumentation.

Read the original at Unit 42 Palo Alto Networks ↗

Topics
Malware
Related